CVE-2026-67204 BookStack < 26.05.4 Broken Access Control via Image Gallery API

BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-update or image-delete permissions to manipulate other users' avatars by exploiting missing content-type restrictions in the Image Gallery API endpoints. Attackers can supply a...

CVE-2026-67204

BookStack before 26.05.4 contains a broken access control vulnerability in the Image Gallery API endpoints . The API controller loads any image type without the content-type restrictions enforced by the web controller's gallery and drawio checks. An authenticated user with image-update or image-d...

EUVD-2026-64919

BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-update or image-delete permissions to manipulate other users' avatars by exploiting missing content-type restrictions in the Image Gallery API endpoints. Attackers can supply a...

CVE-2026-74618

A flaw was found in the Linux kernel's binfmtmisc component. An unprivileged local user can exploit this vulnerability by manipulating user and mount namespaces to repeatedly trigger a warning condition during the mounting of binfmtmisc. This repeated triggering can lead to kernel log flooding,...

CVE-2026-74619

A flaw was found in the Linux kernel's overlay filesystem overlayfs. An unprivileged local user can repeatedly trigger a warning condition by manipulating user and mount namespaces and file system context operations. This can lead to kernel log flooding, kernel tainting, and potentially a system...

grafana-CVE-2018-15727

Exploit di Grafana CVE-2018-15727 Installazione root@kitploit: $ go get github.com/u238/grafana-CVE-2018-15727 Utilizzo root@kitploit: $ source go env $ $GOPATH/bin/grafana-CVE-2018-15727 ldapadmin i delete the grafanasess cookie from your browser session i set following cookies in you browser: f...

CVE-2026-77995

Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client 3.2.0 - The manipulation of a cookie value allows actors to login as arbitrary accounts, including admins...

cve-2025-63888-exploit

CVE-2025-63888 ThinkPHP 5.0.24 File Inclusion RCE Exploit Uno strumento di ricerca sulla sicurezza per rilevare e testare la vulnerabilità CVE-2025-63888 in ThinkPHP 5.0.24, che consente l'esecuzione remota di codice tramite attacchi di inclusione di file. ⚠️ Disclaimer Questo strumento è destinat...

EUVD-2026-64844

Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client 3.2.0 - The manipulation of a cookie value allows actors to login as arbitrary accounts, including admins...

CVE-2026-77995 Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0

Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client 3.2.0 - The manipulation of a cookie value allows actors to login as arbitrary accounts, including admins...

CVE-2026-77995 Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0

Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client 3.2.0 - The manipulation of a cookie value allows actors to login as arbitrary accounts, including admins...

CVE-2026-77995

CVE-2026-77995 is an arbitrary account takeover vulnerability in the miniOrange OAuth Client Joomla extension, affecting versions prior to 3.2.0 . The flaw is caused by the manipulation of a cookie value , allowing an unauthenticated attacker to log in as any account on the site, including admini...

CVE-2024-32019-PoC

CVE-2024-32019-PoC Script Bash per Privilege Escalation tramite "ndsudo" Exploit Locale Netdata Versioni Affette di Netdata = v1.45.0, = v1.44.0-60, v1.45.0-169 Descrizione della Vulnerabilità Lo strumento "ndsudo" esegue un insieme ristretto di comandi esterni, ma i percorsi di ricerca sono...

CVE-2025-8088-Winrar-Tool

CVE-2025-8088 WinRAR Exploit Strumento avanzato per exploit di path traversal in WinRAR Un sofisticato strumento GUI per creare archivi RAR malevoli che sfruttano la vulnerabilità di path traversal di WinRAR CVE-2025-8088 utilizzando ADS e manipolazione degli header RAR5. Caratteristiche...

jboss-autopwn-1

jboss-autopwn JBoss Autopwn come presentato al BlackHat Europe 2010 - questa versione incorpora CVE-2010-0738, la vulnerabilità di bypass dell'autenticazione JBoss tramite manipolazione del verbo VERB, scoperta da Minded Security. C. Papathanasiou 2010 INTRODUZIONE Questo script JBoss distribuisc...

CVE-2024-52475

CVE-2024-52475 Il plugin WordPress Wawp = 3.0.17 è vulnerabile alla Broken Authentication Account takeover Dichiarazione di non responsabilità! Le informazioni fornite in questo documento relative a CVE-2024-52475 sono solo per scopi di apprendimento ed educativi. Non incoraggiamo né autorizziamo...

nomore403

NoMore403 nomore403 is a command-line tool for testing HTTP access-control bypasses and parser inconsistencies around 401, 403, and related responses. The tool is designed for practical web security work: bug bounty, penetration testing, security reviews, and regression testing of access-control...

libfreefare

Introduzione Il progetto libfreefare fornisce un'API pratica per la manipolazione delle schede MIFARE. Fa parte di nfc-tools ; puoi trovare maggiori informazioni su di essi nella wiki di nfc-tools. Se sei nuovo a libfreefare o a nfc-tools , dovresti raccogliere informazioni utili sul sito del...

CVE-2026-1208

CVE-2026-1208: Cross-Site Request Forgery in Friendly Functions for Welcart Parole chiave: CVE-2026-1208, vulnerabilità Friendly Functions for Welcart, CSRF, Cross-Site Request Forgery, sicurezza WordPress, vulnerabilità plugin WordPress, CWE-352, sicurezza Welcart, manipolazione impostazioni,...

cve-2025-29927

Questo è un progetto di esempio Next.js inizializzato con create-next-app per spiegare praticamente come funziona cve-2025-29927. https://nextjs.org/docs/app/api-reference/cli/create-next-app. Per Iniziare Per prima cosa, avvia il server di sviluppo: root@kitploit: npm run dev or yarn dev or pnpm...